Update laravel-forge extension by KevinBatdorf · Pull Request #30454 · raycast/extensions

KevinBatdorf · 2026-08-23T15:52:05Z

Description

This tightens up a few tools and adds one to get a site/server details directly

Also adds wordpress support

Screencast

Checklist

I read the extension guidelines
I read the documentation about publishing
I ran npm run build and tested this distribution build in Raycast
I checked that files in the assets folder are used by the extension itself
I checked that assets used by the README are placed outside of the metadata folder

- Never answer a site search with silent nothing (raycast#40) - Make the deployment tools resolve sites exactly, and read the latest deployment (raycast#39) - Normalize deployment status for the AI tools too (raycast#38) - Upgrade to @raycast/api v2 so the extension runs on Windows (raycast#37) - Declare Windows support (raycast#36)

raycastbot · 2026-08-23T15:52:25Z

Thank you for the update! 🎉

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 15 business days.

greptile-apps · 2026-08-23T16:04:26Z

Greptile Summary

The PR expands the Laravel Forge AI integration with detailed site/server lookup, an arbitrary API probe, stricter resource matching, deployment-status improvements, and revised service actions.

Adds get-site, get-server, and probe-api AI tools.
Refactors site/server lookup, deployment status, and destructive-action confirmations.
Updates the Raycast API dependency and service-management UI.

Confidence Score: 0/5

This PR is not safe to merge until the two secret-disclosure paths and unresolved destructive-action confirmations are fixed.

The new AI tools can return protected Forge content through an encoded-path bypass or an unredacted deployment script, while transient confirmation lookup failures can authorize disruptive operations without showing the resolved target.

Files Needing Attention: extensions/laravel-forge/src/tools/probe-api.ts, extensions/laravel-forge/src/tools/get-site.ts, extensions/laravel-forge/src/tools/deploy-site.ts, extensions/laravel-forge/src/tools/reboot-server.ts, extensions/laravel-forge/src/tools/restart-service.ts, extensions/laravel-forge/src/tools/helpers.ts

Security Review

Two secret-disclosure paths need correction: encoded credential-route names can bypass the API probe's denylist, and get-site returns free-form deployment scripts without redaction.

Important Files Changed

Filename	Overview
extensions/laravel-forge/src/tools/probe-api.ts	Adds an authenticated arbitrary Forge API probe, but its pre-decoding route denylist can be bypassed to expose credential content.
extensions/laravel-forge/src/tools/get-site.ts	Adds detailed site output but includes the deployment script verbatim, potentially exposing embedded credentials.
extensions/laravel-forge/src/tools/helpers.ts	Refactors site/server searching and exact matching; its confirmation helper suppresses all resolution failures.
extensions/laravel-forge/src/tools/deploy-site.ts	Adds richer target confirmation but falls back to unresolved generic confirmation when lookup fails.
extensions/laravel-forge/src/tools/reboot-server.ts	Improves reboot impact details but can omit them after a transient target-resolution failure.
extensions/laravel-forge/src/tools/restart-service.ts	Restricts service actions to Forge-supported combinations but can execute after an unresolved generic confirmation.
extensions/laravel-forge/package.json	Registers new AI tools and upgrades dependencies, including an unused `@raycast/utils` dependency.
extensions/laravel-forge/src/api/Site.ts	Centralizes deployment-status normalization and attaches latest deployment data.
extensions/laravel-forge/src/api/Server.ts	Aligns service names and supported actions with Forge API behavior.
extensions/laravel-forge/src/lib/api.ts	Suppresses tool-mode toasts and includes bounded Forge response details in thrown errors.

Comments Outside Diff (1)

extensions/laravel-forge/src/tools/deploy-site.ts, line 21-22 (link)

Confirmation loses resolved target

When a name-based Forge lookup fails transiently during confirmation, the error is replaced with a generic unresolved prompt; execution then performs a fresh lookup and can deploy the resolved site without the user ever seeing that target. The same fallback also affects reboot and service-action confirmations, where the omitted impact includes every site on the server.

Prompt To Fix With AI

This is a comment left during a code review.
Path: extensions/laravel-forge/src/tools/deploy-site.ts
Line: 21-22

Comment:
**Confirmation loses resolved target**

When a name-based Forge lookup fails transiently during confirmation, the error is replaced with a generic unresolved prompt; execution then performs a fresh lookup and can deploy the resolved site without the user ever seeing that target. The same fallback also affects reboot and service-action confirmations, where the omitted impact includes every site on the server.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Prompt To Fix All With AI

### Issue 1
extensions/laravel-forge/src/tools/probe-api.ts:52-53
**Encoded paths bypass secret guard**

When a credential-route segment is percent-encoded, the raw-path check accepts it before Laravel decodes it for routing, causing environment or credential content under the unredacted `content` attribute to be returned to the model.

**How this was verified:** The encoded segment passes the literal denylist, reaches the authenticated request unchanged, and is decoded to the protected route during Laravel route matching.

### Issue 2
extensions/laravel-forge/src/tools/get-site.ts:37
**Deployment scripts expose embedded secrets**

If a site's free-form deployment script contains a password or token, `get-site` returns it verbatim during an ordinary site lookup, disclosing that credential to the AI context.

**How this was verified:** The Forge attribute is copied into `ISite` and returned directly without passing through the redaction used by the probe tool.

```suggestion

```

### Issue 3
extensions/laravel-forge/src/tools/deploy-site.ts:21-22
**Confirmation loses resolved target**

When a name-based Forge lookup fails transiently during confirmation, the error is replaced with a generic unresolved prompt; execution then performs a fresh lookup and can deploy the resolved site without the user ever seeing that target. The same fallback also affects reboot and service-action confirmations, where the omitted impact includes every site on the server.

### Issue 4
extensions/laravel-forge/package.json:154
**Unused utility dependency added**

`@raycast/utils` is newly declared but is not imported anywhere under `src/`, adding unnecessary installation and maintenance overhead. Remove it from the manifest and lockfile unless the extension uses it.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "Update laravel-forge extension" | Re-trigger Greptile}

greptile-apps · 2026-08-23T16:04:44Z

+  if (/^[a-z]+:\/\//i.test(clean)) throw new Error("Pass a path relative to the Forge API, not a full URL.");
+  if (FORBIDDEN.test(clean)) {


Encoded paths bypass secret guard

When a credential-route segment is percent-encoded, the raw-path check accepts it before Laravel decodes it for routing, causing environment or credential content under the unredacted content attribute to be returned to the model.

How this was verified: The encoded segment passes the literal denylist, reaches the authenticated request unchanged, and is decoded to the protected route during Laravel route matching.

Prompt To Fix With AI

This is a comment left during a code review. Path: extensions/laravel-forge/src/tools/probe-api.ts Line: 52-53 Comment: **Encoded paths bypass secret guard** When a credential-route segment is percent-encoded, the raw-path check accepts it before Laravel decodes it for routing, causing environment or credential content under the unredacted `content` attribute to be returned to the model. **How this was verified:** The encoded segment passes the literal denylist, reaches the authenticated request unchanged, and is decoded to the protected route during Laravel route matching. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-08-23T16:04:44Z

+    deploymentRetention: found.deployment_retention,
+    usesEnvoyer: found.uses_envoyer,
+    deploymentStatus: siteDeploymentStatus(found),
+    deploymentScript: found.deployment_script,


Deployment scripts expose embedded secrets

If a site's free-form deployment script contains a password or token, get-site returns it verbatim during an ordinary site lookup, disclosing that credential to the AI context.

How this was verified: The Forge attribute is copied into ISite and returned directly without passing through the redaction used by the probe tool.

Suggested change

deploymentScript: found.deployment_script,

Prompt To Fix With AI

This is a comment left during a code review. Path: extensions/laravel-forge/src/tools/get-site.ts Line: 37 Comment: **Deployment scripts expose embedded secrets** If a site's free-form deployment script contains a password or token, `get-site` returns it verbatim during an ordinary site lookup, disclosing that credential to the AI context. **How this was verified:** The Forge attribute is copied into `ISite` and returned directly without passing through the redaction used by the probe tool. ```suggestion ``` --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-08-23T16:04:44Z

  "dependencies": {
-    "@raycast/api": "^1.104.24",
+    "@raycast/api": "^2.0.5",
+    "@raycast/utils": "^2.3.0",


Unused utility dependency added

@raycast/utils is newly declared but is not imported anywhere under src/, adding unnecessary installation and maintenance overhead. Remove it from the manifest and lockfile unless the extension uses it.

Rule Used: What: Every dependency listed in package.json must... (source)

Prompt To Fix With AI

This is a comment left during a code review. Path: extensions/laravel-forge/package.json Line: 154 Comment: **Unused utility dependency added** `@raycast/utils` is newly declared but is not imported anywhere under `src/`, adding unnecessary installation and maintenance overhead. Remove it from the manifest and lockfile unless the extension uses it. **Rule Used:** What: Every dependency listed in package.json must... ([source](https://app.greptile.com/raycast/-/custom-context?memory=bffc60eb-f9f2-4219-b804-76e29e267d43)) --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

raycastbot added extension fix / improvement Label for PRs with extension's fix improvements extension: laravel-forge Issues related to the laravel-forge extension AI Extension platform: macOS platform: Windows OP is author The OP of the PR is the author of the extension labels Aug 23, 2026

greptile-apps Bot reviewed Aug 23, 2026

View reviewed changes

KevinBatdorf mentioned this pull request Aug 24, 2026

Close the leaks the store review found (#30454) KevinBatdorf/laravel-forge-raycast#41

Merged

Navigation Menu

Uh oh!

Update laravel-forge extension - #30454

Update laravel-forge extension#30454
KevinBatdorf wants to merge 1 commit into
raycast:mainfrom
KevinBatdorf:ext/laravel-forge

KevinBatdorf commented Aug 23, 2026 •

edited

Loading

Uh oh!

raycastbot commented Aug 23, 2026

Uh oh!

greptile-apps Bot commented Aug 23, 2026 •

edited

Loading

Security Review

Comments Outside Diff (1)

Uh oh!

greptile-apps Bot Aug 23, 2026

Uh oh!

greptile-apps Bot Aug 23, 2026

Uh oh!

greptile-apps Bot Aug 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		if (/^[a-z]+:\/\//i.test(clean)) throw new Error("Pass a path relative to the Forge API, not a full URL.");
		if (FORBIDDEN.test(clean)) {

Uh oh!

Conversation

KevinBatdorf commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Screencast

Checklist

Uh oh!

raycastbot commented Aug 23, 2026

Uh oh!

greptile-apps Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 0/5

Security Review

Important Files Changed

Comments Outside Diff (1)

Uh oh!

greptile-apps Bot Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Aug 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

KevinBatdorf commented Aug 23, 2026 •

edited

Loading

greptile-apps Bot commented Aug 23, 2026 •

edited

Loading